Expand key for template cache in IPFix and v9#167
Expand key for template cache in IPFix and v9#167rachelScout wants to merge 4 commits intoEdgio:masterfrom
Conversation
bb195b1 to
093b7bf
Compare
Add missing field to sflow example in Readme https://github.com/EdgeCast/vflow/blob/79067e83bb5d1ad147134b4b9f4be7f75de69594/sflow/decoder.go#L59
7b0f583 to
87be2c7
Compare
f3bcbe3 to
cdacb22
Compare
|
A pcap that demonstrates the problem is attached. In packet #1 and #2, template id 257 is being sent on domain id 3. Now comes packet #4, which demonstrates the problem. It has template id 257, and domain 3, so it should be parsed using the template from packet #1, and not the template seen later, in packet #3. In vflow without the fix, packet #4 is being parsed based on packet #3, because it came later, and vflow ignores the domain id. In vflow with the fix, packet #4 is being parsed on the packet #1, because that's the packet which matches the combination of sender IP + template id + domain id. |
Currently V9 and IPFIX templates are cached using template id and exporter address as a key.
Rfc3954 implies that v9 templates should be cached using the following fields:
msg header Source ID
exporter source IP
Template id
As stated below:
Source ID:
A 32-bit value that identifies the Exporter Observation Domain.
NetFlow Collectors SHOULD use the combination of the source IP
address and the Source ID field to separate different export
streams originating from the same Exporter.